Commit `3a7b3219b3`

3a7b3219b30badf4216dd113f8b149ebf1568cee

parent: eee4509235

Verified · cmc ci/build: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-03 16:48 UTC

gitbayd: header and idle timeouts, and a drain on SIGTERM

The HTTP server had no timeouts at all, so a few slow clients holding
headers open could starve the public listener. It now has a 10 s
ReadHeaderTimeout, a 2 min IdleTimeout and a 64 KiB header cap, and the
ACME HTTP-01 listener the same; no write timeout, since archives and
upload-pack stream for as long as they take.

serve blocked on the first listener error and a deploy's restart was a
plain kill. It now traps SIGINT and SIGTERM, closes the ssh and git
listeners, drains the HTTP server and every accepted SSH session (a
push in flight completes) for up to 30 s, and exits 0.

TestServeStopsOnSIGTERM: the daemon exits cleanly within 15 s and the
listener is gone.

Closes #104
Closes #105

Layout: unified · split

cmd/gitbayd/main.go +47 −3

 	"net"
 	"net/http"
 	"os"
+	"os/signal"
 	"path/filepath"
 	"strconv"
 	"strings"
+	"syscall"
 	"time"
 	"github.com/spf13/cobra"
 			}
 			defer stopHookd()
+			// SIGTERM is how a deploy restarts the daemon: stop accepting,
+			// let what is in flight finish, exit 0 (#105).
+			ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+			defer stop()
 			// Outbound webhook deliveries. The retry base is overridable
 			// for tests via GITBAY_WEBHOOK_RETRY_BASE.
 			retryBase := 30 * time.Second
 			}, buildinfo.String()).Run(whCtx)
 			errCh := make(chan error, 3)
+			var sshSrv *sshd.Server
+			var sshLn, gitLn net.Listener
 			if cfg.SSH.Mode == "embedded" {
 				srv, err := sshd.New(cfg, st)
 				if err != nil {
 					return err
 				}
 				slog.Info("ssh listening", "addr", ln.Addr())
+				sshSrv, sshLn = srv, ln
 				go func() { errCh <- srv.Serve(ln) }()
 			} else {
 				// system mode: the host sshd owns the SSH port and invokes
 			}
 			web := httpd.New(cfg, st)
-			hs := &http.Server{Addr: cfg.HTTP.Addr, Handler: web.Handler()}
+			// Header and idle timeouts bound what an idle or slow client can
+			// hold open. No write timeout: archives and upload-pack stream
+			// for as long as they take (#104).
+			hs := &http.Server{
+				Addr:              cfg.HTTP.Addr,
+				Handler:           web.Handler(),
+				ReadHeaderTimeout: 10 * time.Second,
+				IdleTimeout:       2 * time.Minute,
+				MaxHeaderBytes:    64 << 10,
+			}
 			go func() {
 				slog.Info("http listening", "addr", cfg.HTTP.Addr, "tls", cfg.HTTP.TLS)
 				switch cfg.HTTP.TLS {
 						})
 						go func() {
 							slog.Info("acme http listening", "addr", addr)
-							if err := http.ListenAndServe(addr, m.HTTPHandler(redirect)); err != nil {
+							acmeHTTP := &http.Server{Addr: addr, Handler: m.HTTPHandler(redirect),
+								ReadHeaderTimeout: 10 * time.Second, IdleTimeout: time.Minute}
+							if err := acmeHTTP.ListenAndServe(); err != nil {
 								slog.Warn("acme http listener failed; continuing with TLS-ALPN only", "err", err)
 							}
 						}()
 					return err
 				}
 				slog.Info("git-daemon listening", "addr", gln.Addr())
+				gitLn = gln
 				go func() { errCh <- gitd.New(cfg, st).Serve(gln) }()
 			}
-			return <-errCh
+			select {
+			case err := <-errCh:
+				return err
+			case <-ctx.Done():
+			}
+			slog.Info("shutting down")
+			stop()
+			for _, ln := range []net.Listener{sshLn, gitLn} {
+				if ln != nil {
+					ln.Close()
+				}
+			}
+			drain, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancel()
+			if err := hs.Shutdown(drain); err != nil {
+				slog.Warn("http shutdown", "err", err)
+			}
+			if sshSrv != nil {
+				if err := sshSrv.Shutdown(drain); err != nil {
+					slog.Warn("ssh shutdown", "err", err)
+				}
+			}
+			return nil
 		},
 	}
 }

e2e/shutdown_test.go added +34

@@ -0,0 +1,34 @@
	1	package e2e
	2
	3	import (
	4	"net/http"
	5	"syscall"
	6	"testing"
	7	"time"
	8	)
	9
	10	// SIGTERM is how a deploy restarts the daemon. It used to be a plain
	11	// kill: no listener closed, no request or push allowed to finish. The
	12	// daemon now stops its listeners, drains, and exits 0 (#105).
	13	func TestServeStopsOnSIGTERM(t *testing.T) {
	14	inst := startInstance(t)
	15	if resp, err := http.Get(inst.base() + "/healthz"); err != nil \|\| resp.StatusCode != 200 {
	16	t.Fatalf("healthz before shutdown: %v", err)
	17	}
	18	if err := inst.proc.Process.Signal(syscall.SIGTERM); err != nil {
	19	t.Fatal(err)
	20	}
	21	done := make(chan error, 1)
	22	go func() { done <- inst.proc.Wait() }()
	23	select {
	24	case err := <-done:
	25	if err != nil {
	26	t.Fatalf("daemon did not exit cleanly on SIGTERM: %v", err)
	27	}
	28	case <-time.After(15 * time.Second):
	29	t.Fatal("daemon still running 15s after SIGTERM")
	30	}
	31	if _, err := http.Get(inst.base() + "/healthz"); err == nil {
	32	t.Fatal("http listener still answering after shutdown")
	33	}
	34	}

internal/sshd/sshd.go +25 −1

 package sshd
 import (
+	"context"
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/base64"
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 	"golang.org/x/crypto/ssh"
 	st          *store.Store
 	sshCfg      *ssh.ServerConfig
 	authLimiter *rateLimiter
+	sessions    sync.WaitGroup // accepted connections still being served
 }
 func New(cfg config.Config, st *store.Store) (*Server, error) {
 		if err != nil {
 			return err
 		}
-		go s.handleConn(conn)
+		s.sessions.Add(1)
+		go func() {
+			defer s.sessions.Done()
+			s.handleConn(conn)
+		}()
+	}
+}
+// Shutdown waits for every accepted connection to finish, or for ctx. The
+// caller closes the listener first; a push in flight completes rather
+// than being cut mid-pack.
+func (s *Server) Shutdown(ctx context.Context) error {
+	done := make(chan struct{})
+	go func() {
+		s.sessions.Wait()
+		close(done)
+	}()
+	select {
+	case <-done:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
 	}
 }

Commit 3a7b3219b3

Commit `3a7b3219b3`